Best practices for Terraform with Vault
2 likes23,928 views
For HashiCorp fans, Terraform and Vault have been the go-to products for provisioning and securing cloud infrastructure as organizations move to the cloud. Terraform is releasing 0.12 and Vault surpassed 1.0 (and is now at 1.1). Many organizations have already adopted Terraform and Vault and are looking to adopt Consul. However, as organizations mature in usage of the HashiCorp stack, how can the various products work together to further optimize workflows? In this webinar, we’ll walk you through best practices for using Vault to secure data with Terraform.
![TERMINAL
$ vault policy write dev-policy -<<EOF
path "aws/creds/dev-role" {
capabilities = ["read"]
}
EOF
$ vault auth enable github
$ vault write auth/github/config organization=hashicorp ttl=86400s
$ vault write auth/github/map/teams/vault value=dev-policy](https://image.slidesharecdn.com/bestpracticesforterraformwithvault-190516161149/85/Best-practices-for-Terraform-with-Vault-20-320.jpg)
![TERMINAL
$ vault secrets enable aws
$ vault write aws/config/root
access_key=$AWS_ACCESS_KEY_ID
secret_key=$AWS_SECRET_ACCESS_KEY
region=us-east-1
$ vault write aws/roles/dev-role
credential_type=iam_user
policy_document=-<<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
}
]
}
EOF
$ vault write aws/config/lease lease=5m lease_max=5m](https://image.slidesharecdn.com/bestpracticesforterraformwithvault-190516161149/85/Best-practices-for-Terraform-with-Vault-21-320.jpg)
![TERMINAL
terraform {
required_version = ">= 0.11.8"
}
provider "vault" {
address = "${var.vault_addr}"
}
data "vault_aws_access_credentials" "aws_creds" {
backend = "aws"
role = "dev-role"
}
provider "aws" {
access_key = "${data.vault_aws_access_credentials.aws_creds.access_key}"
secret_key = "${data.vault_aws_access_credentials.aws_creds.secret_key}"
region = "${data.external.region.result["region"]}"
}](https://image.slidesharecdn.com/bestpracticesforterraformwithvault-190516161149/85/Best-practices-for-Terraform-with-Vault-23-320.jpg)
![TERMINAL
terraform {
required_version = ">= 0.11.8"
}
provider "vault" {
address = "${var.vault_addr}"
}
data "vault_generic_secret" "database" {
path = "database/creds/dev-role"
}
provider "some-provider" {
username = "${data.vault_generic_secret.database.data["username"]}"
username = "${data.vault_generic_secret.database.data["password"]}"
}](https://image.slidesharecdn.com/bestpracticesforterraformwithvault-190516161149/85/Best-practices-for-Terraform-with-Vault-24-320.jpg)
More Related Content
What's hot (20)
Similar to Best practices for Terraform with Vault (20)
More from Mitchell Pronschinske (20)
Recently uploaded (20)
![Passive House Canada Conference 2025 Presentation [Final]_v4.ppt](https://cdn.slidesharecdn.com/ss_thumbnails/phcc2025presentationfinalv4-250512155835-5098a2a9-thumbnail.jpg?width=560&fit=bounds)
Best practices for Terraform with Vault
- 2. Best Practices for Terraform with Vault Becca Petrin (she/her) Software Engineer Vault Ecosystem HashiCorp
- 3. Topics 1. Getting Started Using Terraform 2. Recommended Architecture 3. Seeding Vault with Secrets 4. Consuming Those Secrets
- 4. Terraform Write, plan, and create infrastructure as code. Vault Manage secrets and protect sensitive data. Consul Service mesh made easy. AWS Cloud computing services.
- 5. Getting Started Using Terraform Section 1 of 4
- 6. TERMINAL $ aws configure $ git clone [email protected]:hashicorp/vault-guides.git $ cd vault-guides/operations/provision-vault/best-practices/terraform-aws/ $ terraform init $ terraform apply
- 7. TERMINAL terraform { backend "s3" { bucket = "remote-terraform-state-best-practices-demo" encrypt = true key = "terraform.tfstate" region = "us-east-1" } }
- 10. Workflow Two Secrets are placed into Vault. One Terraform spins up Vault backed by Consul. Three Terraform pulls secrets from Vault.
- 13. Seeding Vault with Secrets Section 3 of 4
- 14. Every Morning She Gets a Vault Token
- 16. Then She Runs Terraform Terraform State Username: Very Password: Precious
- 18. Benefits ▪ Reduces insider threat ▪ Auditability ▪ Nixes credential sharing ▪ You don’t have to commit in your Terraform config
- 20. TERMINAL $ vault policy write dev-policy -<<EOF path "aws/creds/dev-role" { capabilities = ["read"] } EOF $ vault auth enable github $ vault write auth/github/config organization=hashicorp ttl=86400s $ vault write auth/github/map/teams/vault value=dev-policy
- 21. TERMINAL $ vault secrets enable aws $ vault write aws/config/root access_key=$AWS_ACCESS_KEY_ID secret_key=$AWS_SECRET_ACCESS_KEY region=us-east-1 $ vault write aws/roles/dev-role credential_type=iam_user policy_document=-<<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:*", "Resource": "*" } ] } EOF $ vault write aws/config/lease lease=5m lease_max=5m
- 22. Consuming Those Secrets Section 4 of 4
- 23. TERMINAL terraform { required_version = ">= 0.11.8" } provider "vault" { address = "${var.vault_addr}" } data "vault_aws_access_credentials" "aws_creds" { backend = "aws" role = "dev-role" } provider "aws" { access_key = "${data.vault_aws_access_credentials.aws_creds.access_key}" secret_key = "${data.vault_aws_access_credentials.aws_creds.secret_key}" region = "${data.external.region.result["region"]}" }
- 24. TERMINAL terraform { required_version = ">= 0.11.8" } provider "vault" { address = "${var.vault_addr}" } data "vault_generic_secret" "database" { path = "database/creds/dev-role" } provider "some-provider" { username = "${data.vault_generic_secret.database.data["username"]}" username = "${data.vault_generic_secret.database.data["password"]}" }
- 25. TERMINAL $ vault login -method=github token=$GITHUB_TOKEN $ export VAULT_TOKEN=s.dSwQTUmTR30zyEWwPzcxBxu1 $ terraform apply
- 26. Summary Two Secrets are placed into Vault. One Terraform spins up Vault backed by Consul. Three Terraform pulls secrets from Vault.
- 27. References Vault Reference Architecture https://learn.hashicorp.com/vault/operations/ops-reference-archi tecture Best Practices Vault Cluster on AWS https://github.com/hashicorp/vault-guides/tree/master/operation s/provision-vault/best-practices/terraform-aws Production Hardening Guide https://www.vaultproject.io/guides/operations/production How to Pull AWS Keys from Vault https://github.com/rberlind/aws-ec2-instance/tree/from-vault Copyright © 2019 HashiCorp